BouncyCastle CMSSignedDataStreamGenerator更改符号上的数据

Question

I have the following java code (BouncyCastle 1.48):

CMSSignedDataStreamGenerator generator = new CMSSignedDataStreamGenerator();
generator.addSignerInfoGenerator(signerInfoGenerator);
generator.addCertificates(certStore);
FileOutputStream fos = new FileOutputStream("D:\\Data\\Desktop\\Test\\singedData.txt");
OutputStream theSignedDataStream = generator.open(fos, true);

IOUtils.copy(new FileInputStream("D:\\Data\\Desktop\\Test\\unsignedData.txt"), theSignedDataStream);

Now: The data is signed and written to the signedData.txt file. The problem is that some characters are written wrong (the data is a mime container that has base64-encoded content). Here is a snippet from the data:

ICAgIDxOQU1FLUFERFJFU1M+CiAgICAgICAgICA8TkFNRT4KICAgICAgICAgICAg
PExpbmUtMzU+TXVzdGVya3VuZGUgUGV0ZXIgSHV???,???èiZXI8L0xpbmUtMzU+CiAgICAg
ICAgICA8L05BTUU+CiAgICAgICAgICA8U1RSRUVUPgogICAgICAgICAgICA8TGlu

Where the ???,??? stands for [EOT],[ETX] (ascii control characters for 'end of transmission' and 'end of text'. In the original source-data, there is nothing where the wrong characters appear: ...SHV???,???éiZX... is originally ...SHViZHX...

A second snippet:

Content-Transfer-Encoding: base64
Content-Type: application/pdf
Content-[EOT]‚[ETX]Description: The PDF Title

Can anybody help me out here? What am I doing wrong?

Best regards, Florian

Answer 1

Do you understand that CMS SignedData is in ASN.1 format? This means there are extra fields and structural tags; your original data is encapsulated in this structure. If you don't want to encapsulate the original data, but just produce a signature, then pass 'false' for the 'encapsulate' argument to open(). ie generator.open(fos, false);

Of course, you may then need to send the original data along with the signature, depending on what you are trying to achieve.

If you are interested, the "every 1000 letters" is due to the generator breaking up your data "octet-string" into 1000-byte chunks, as part of the BER encoding produced by CMSSignedDataStreamGenerator (BER is one way of encoding an ASN.1 structure like SignedData).

I would also consider whether you should be signing the Base-64 encoding of your content, or perhaps the raw content bytes would be more appropriate. Obviously anyone trying to verify your signature would need to be clear on what exactly was signed.